detecting-broken-object-property-level-authorization - Detect Broken Object Property Level Authorization
Detects OWASP API3:2023 vulnerabilities involving excessive data exposure and mass assignment in APIs.
Tags
Updated: 2026-09-30Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Detect excessive data exposure
- Test mass assignment
- Classify sensitive properties
- Compare response fields
- Verify injected changes
Inputs
- Target API
- API documentation or schema
- Authentication headers
- User accounts
- API endpoints
- Expected response fields
Outputs
- BOPLA findings
- Vulnerability classifications
- Sensitive property names
- API request results
- Modified API object state
Requirements
- Python 3.8 or later
- Python requests library
- API security testing authorization
- API endpoints accepting object data
- Burp Suite or Postman